Old WordPress may be vulnerable to spammers

A friend of mine who runs some quality sites got this email from Google:

Dear site owner or webmaster of example.com,

While we were indexing your webpages, we detected that some of your pages were using techniques that were outside our quality guidelines, which can be found here: http://www.google.com/webmasters/guidelines.html In order to preserve the quality of our search engine, we have temporarily removed some webpages from our search results. Currently pages from example.com are scheduled to be removed for at least 30 days. Specifically, we detected the following practices on your webpages: * The following hidden text on example.com: e.g. payday loan (several more spammy links) […]

We would prefer to have your pages in Google’s index. If you wish to be reconsidered, please correct or remove all pages that are outside our quality guidelines. When you are ready, please visit: https://www.google.com/webmasters/tools/reinclusion?hl=en to learn more and request a reconsideration request.

Sincerely,
Google Search Quality Team

This is enough to send a shiver down the proverbial. My friend suspected WordPress to be the culprit, as it is present on his sites and it is out of date. But he could not find the problem in the templates. I took a quick look.

First I suspected a proxy hijack. I searched for inurl:example.com in Google and among a few results, there was this:

blah.com/blah/nph-search.pl/010110A/http/www.example.com/blog/

Turns out to be a proxy script with just a form on the home page. It was likely to be another site that contained a link to the above URL. The latter site was probably crawled and therefore the link was indexed.

Then I searched for his domain name with some of the spammy words and found a single article. In a single location in the first paragraph there was a long string of linked URLs whose HTML code looked like this (spaces deliberately inserted below):

My friend has cleaned out this code and upgraded WordPress to the latest version. I am waiting for Fantastico to catch up, as I am only one version behind, and will follow suit. Suggest that you check your version soon.

Related Posts

Feel free to share...After Mr Donald Trump became the president at noon today (USA EST), many reported that the whitehouse.gov website removed references to Climate Change and LGBT. That isn’t entirely accurate. The website up to that point has been archived and can be found at https://obamawhitehouse.archives.gov/. The LGBT URL was https://www.whitehouse.gov/lgbt but it redirects […]

Feel free to share...Australia has six- and ten-digit local numbers that begin with 13 and 1300 respectively. The 13 xx xx numbers connect you to a local number in your city so it is a local call. The 1300 xxx xxx number is similar but is usually a single destination for the price of a […]